~evergreen-bugs/evergreen/rel_3

~evergreen-bugs/evergreen/rel_3_11 » Changes from revision 26896

From Revision 26881 to 26862

Rev	Summary	Authors	Date
26881	3.11.5-3.11.6 DB update 3.11.5-3.11.6 DB update Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Galen Charlton	7 months ago
26880	3.10.4-3.10.5 version upgrade script 3.10.4-3.10.5 version upgrade script Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Galen Charlton	7 months ago
26879	LP2019157: Mitigate reflected XSS vulnerability in OPAC LP2019157: Mitigate reflected XSS vulnerability in OPAC To test: 1. If you don't already have a library group, go to Admin > Server > Library Groups and make one that is Global. 2. In your browser, go to [your_domain]/eg/opac/home?locg='><script>alert('bad bad bad')</script> 3. Note that the site executes javascript code that is passed in via the URL. 4. Apply this patch 5. Repeat step 2. 6. Note that the arbitrary js does not get run anymore. 7. Confirm that library group searching still works as expected. Release-note: Mitigate a reflected cross-site scripting (XSS) vulnerability in the public catalog. Signed-off-by: Jane Sandberg <sandbergja@gmail.com> Signed-off-by: Jason Stephenson <jason@sigio.com> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Jane Sandberg	7 months ago
26878	LP2069959: Remove reflected XSS vulnerability from OPAC brow... LP2069959: Remove reflected XSS vulnerability from OPAC browse Release-note: Remediates a reflected Cross-site Scripting (XSS) vulnerability in the public catalog browse feature. With thanks to Jeff Davis, Chris Sharp, Jason Stephenson, and Galen Charlton for their work on the TPAC version of this vulnerability in LP #1822630. To test: 1. Go to /eg/opac/browse?blimit="/><script>alert('BAD')</script> in your browser 2. If you see the notice "BAD" pop up, it means that the page is vulnerable to users adding arbitrary javascript to the URL and having it run in the page. Signed-off-by: Jane Sandberg <js7389@princeton.edu> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Jane Sandberg	7 months ago
26877	lp2070078 (follow-up) make sure subroutine has access to lp2070078 (follow-up) make sure subroutine has access to Signed-off-by: Jane Sandberg <js7389@princeton.edu> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Jane Sandberg	7 months ago
26876	lp2070078: Check event hook before loading; Confirm bib ID(s... lp2070078: Check event hook before loading; Confirm bib ID(s) are actually bibs Release-note: Patch Insecure direct object reference (IDOR) vulnerability for action trigger output in OPAC list printing feature. Signed-off-by: Mike Rylander <mrylander@gmail.com> Signed-off-by: Jane Sandberg <js7389@princeton.edu> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Mike Rylander	7 months ago
26875	LP2058747 Fix "(current)" in staff catalog pagination LP2058747 Fix "(current)" in staff catalog pagination Corrects the staff catalog pagination's screen reader text so that only the current page announces itself as current. Changes visually-hidden text to ARIA labels and adds better internationalization support. Also corrects some link/button errors. Release-note: Corrects current page ARIA in staff catalog pagination Signed-off-by: Stephanie Leary <stephanie.leary@equinoxoli.org> Signed-off-by: Terran McCanna <tmccanna@georgialibraries.org> Signed-off-by: Michele Morgan <mmorgan@noblenet.org> Signed-off-by: Steven Mayo <smayo@georgialibraries.org>	Stephanie Leary	8 months ago
26874	LP2015112 Hide Edit Call Number Link if Missing Permissions LP2015112 Hide Edit Call Number Link if Missing Permissions Hides the Edit call number link on the Angular staff catalog copy table if the user does not have permissions to edit. Release-note: Hides Edit call number link if missing permission Signed-off-by: Terran McCanna <tmccanna@georgialibraries.org> Signed-off-by: Steven Mayo <smayo@georgialibraries.org> Signed-off-by: Michele Morgan <mmorgan@noblenet.org>	Terran McCanna	8 months ago
26873	LP#2003090 Angular Daily Cash Report Missing Print Capabilit... LP#2003090 Angular Daily Cash Report Missing Print Capability Administration->Local Administration->Cash Reports Release-note: Add a print button to the Desk and Staff User Payment grids to print the org, date range, totals, and full list. Signed-off-by: Dan Briem <dbriem@wlsmail.org> Signed-off-by: Michele Morgan <mmorgan@noblenet.org> Signed-off-by: Terran McCanna <tmccanna@georgialibraries.org>	Dan Briem	8 months ago
26872	LP#2059974: stamp DB update LP#2059974: stamp DB update Signed-off-by: blake <blake@mobiusconsortium.org>	blake	8 months ago
26871	LP#2059974: Restrict search length for suggestions LP#2059974: Restrict search length for suggestions Long searches (many words) with few hits can cause performance issues stemming from the combinatorial effect of suggestion efficacy testing. IOW, things like full-title searches that match well (and therefore produce few results, triggering suggestion) can cause cstore and database backends to spin uselessly. This commit restricts searches to a three (3) term cap by default when deciding whether to generate suggestions using the current single-class/multi-word infrastructure. The term count limit can be adjusted by changing the value of the Global Flag called search.max_suggestion_search_terms to be the desired max-words integer value. If the Global Flag is disabled, the default value of 3 is enforced. This is a blunt instrument, but plans for a nuanced replacement are in place for the next round of Did You Mean development. Signed-off-by: Mike Rylander <mrylander@gmail.com> Signed-off-by: Elizabeth Davis <elizabeth.davis@sparkpa.org> Signed-off-by: blake <blake@mobiusconsortium.org>	Mike Rylander	8 months ago
26870	LP#2037564: Selfcheck cover art without ISBNS not shown LP#2037564: Selfcheck cover art without ISBNS not shown Fixes the display of uploaded cover images in the Selfcheck holds list. Josh Stompro needs to get credit for this, he explained exactly how to fix it in the LP bug. To test in concerto: 1. Find a bib with a cover image and download it. (example search: piano concerto) 2. Upload the cover image to a bib that does not have a cover image. 3. In a patron record, place holds for these 2 titles, and one other title that does not have an image. 4. Initialize and login to selfcheck (https://[hostname]/eg/circ/selfcheck/main) 5. Login as the patron with holds and view the holds list. The uploaded image is not displayed. 6. Apply the patch. 7. Repeat steps 4 & 5. The uploaded image now displays. Release-note: Fixes issue where cover images were not displayed in the selfcheck holds list for titles that lack ISBNs. Signed-off-by: Garry Collum <gcollum@gmail.com> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Garry Collum	9 months ago
26869	LP#2062023: stamp DB update LP#2062023: stamp DB update Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Galen Charlton	9 months ago
26868	LP#2062023 PATRON_BARRED.override permission missing in seed... LP#2062023 PATRON_BARRED.override permission missing in seed data Added PATRON_BARRED.override permission to seed data and with an upgrade script. Release-note: Add `PATRON_BARRED.override` permission if missing. Signed-off-by: Steven Mayo <smayo@georgialibraries.org> Signed-off-by: Jane Sandberg <js7389@princeton.edu> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Steven Mayo	9 months ago
26867	LP2060153: Store remote file for EDI message sent via SFTP LP2060153: Store remote file for EDI message sent via SFTP In a case of "Net::SFTP::Foreign is not Net::FTP," the remote filename is not recorded when sending an EDI message via SFTP. Instead, the return value from the SFTP put function is stored in the remote_file column of the acq.edi_message entry. This is "1" on success and null or undefined on failure. This commit corrects that and puts the remote filename in the proper place. To verify the bug, set up a test account to send EDI messages via SFTP to another server or to another account on the local host. Create an acquisitions order with that account and then activate it. Run the EDI order pusher (edi_order_pusher.pl). Verify that the order arrived in the destination location, and then check the acq.edi_message table entry for this order. The remote_file column value should be "1". To verify the fix, repeat the above steps with a new order. When you check the acq.edi_message table, the remote_file column value should now be the path to the file at the destination. Release-Note: Get actual remote file name when sending EDI message via SFTP. Signed-off-by: Jason Stephenson <jason@sigio.com> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Jason Stephenson	9 months ago
26866	LP#2055089: stamp DB update LP#2055089: stamp DB update Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Galen Charlton	9 months ago
26865	LP2055089 Add missing shipment notification permissions LP2055089 Add missing shipment notification permissions Adds missing permissions for MANAGE_SHIPMENT_NOTIFICATION and VIEW_SHIPMENT_NOTIFICATION to the seed data. Release-note: Adds missing shipment notification permissions Signed-off-by: Llewellyn Marshall <llewellyn.marshall@ncdcr.gov> Signed-off-by: Terran McCanna <tmccanna@georgialibraries.org> Signed-off-by: Steven Mayo <smayo@georgialibraries.org> Signed-off-by: Michele Morgan <mmorgan@noblenet.org> Signed-off-by: Galen Charlton <gmc@equinoxOLI.org>	Llewellyn Marshall	9 months ago
26864	LP#1949214: do not jump-on-single-hit when doing metarecord ... LP#1949214: do not jump-on-single-hit when doing metarecord search in staff catalog This patch fixes an issue where the staff catalog search would attempt to jump to a bib record whose ID was the same as the metarecord when doing a metarecord ("Group Formats/Editions") search that returns a single hit. Unlike the OPAC, this patch does not attempt to jump to the bib when the single metarecord has only one constituent record. To test ------- [1] Turn on the "Jump to details on 1 hit (staff client)" library setting. [2] Perform a metarecord search in the staff catalog that results in a single hit. Observe that the staff catalog jumps to an incorrect record (or no record at all). [3] Apply the patch and repeat step to. This time, the catalog should display the correct search results without attempting to jump to a single record. [4] Verify that the patch does not break jumping to the record when doing a non-metarecord search that returns a single hit. Release-note: Fixes problem where the staff catalog could attempt to jump to an incorrect record when performing a metarecord search that returns a single result. Signed-off-by: Galen Charlton <gmc@equinoxOLI.org> Signed-off-by: Jane Sandberg <js7389@princeton.edu>	Galen Charlton	9 months ago
26863	LP2052641 follow-up: use spaces instead of tab to keep lint ... LP2052641 follow-up: use spaces instead of tab to keep lint happy Signed-off-by: Jane Sandberg <js7389@princeton.edu>	Jane Sandberg	9 months ago
26862	LP2052641 Statistical Popularity Badge Editor Field Order LP2052641 Statistical Popularity Badge Editor Field Order This adjusts the order the fields appear in the grid columns and in the modal for Administration > Local Administration > Statistical Popularity Badges to match the order they are described in the Evergreen documentation. Release-note: Reorders the fields for Local Admin > Statistical Popularity Badges Signed-off-by: Terran McCanna <tmccanna@georgialibraries.org> Signed-off-by: Jane Sandberg <js7389@princeton.edu>	Terran McCanna	10 months ago

Older »